[Devel] [PATCH rh7 2/2] exit: clear TIF_MEMDIE after exit_task_work

[Konstantin Khorenko]

Kirill, please review the patch.

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 02/29/2016 06:58 PM, Vladimir Davydov wrote:
> An mm_struct may be pinned by a file. An example is vhost-net device
> created by a qemu/kvm (see vhost_net_ioctl -> vhost_net_set_owner ->
> vhost_dev_set_owner). If such process gets OOM-killed, the reference to
> its mm_struct will only be released from exit_task_work -> ____fput ->
> __fput -> vhost_net_release -> vhost_dev_cleanup, which is called after
> exit_mmap, where TIF_MEMDIE is cleared. As a result, we can start
> selecting the next victim before giving the last one a chance to free
> its memory. In practice, this leads to killing several VMs along with
> the fattest one.
>
> https://jira.sw.ru/browse/PSBM-44683
>
> Signed-off-by: Vladimir Davydov <vdavydov at virtuozzo.com>
> ---
>   kernel/exit.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/exit.c b/kernel/exit.c
> index 1cc765b48bd7..2715dc1dc0f5 100644
> --- a/kernel/exit.c
> +++ b/kernel/exit.c
> @@ -520,8 +520,6 @@ static void exit_mm(struct task_struct * tsk)
>   	task_unlock(tsk);
>   	mm_update_next_owner(mm);
>   	mmput(mm);
> -	if (test_thread_flag(TIF_MEMDIE))
> -		exit_oom_victim();
>   }
>
>   /*
> @@ -819,6 +817,10 @@ void do_exit(long code)
>   	exit_fs(tsk);
>   	exit_task_namespaces(tsk);
>   	exit_task_work(tsk);
> +
> +	if (test_thread_flag(TIF_MEMDIE))
> +		exit_oom_victim();
> +
>   	check_stack_usage();
>   	exit_thread();
>
>